Apply changes
Describe an infrastructure change as a small, typed mutation of your branch.
The change contract
Every mutation identifies the branch, operation, resource type, and resource ID. fields contains the properties to add or modify. Omit it for a delete.
| Parameter | Type | Meaning |
|---|---|---|
| branch_id | string | ID of an open branch |
| op | add | modify | delete | Operation in the model |
| resource_type | string | Supported resource type |
| resource_id | string | Resource identifier |
| fields | object · optional | Schema fields for the mutation |
Supported resources
These resource types and operations can be changed on a branch. Collection coverage is broader than mutation coverage; a collected resource is not automatically editable. GET /branches/capabilities returns the authoritative, machine-readable contract, including field constraints. GET /branches/field-catalog lists every settable field and the AWS API member it stands for, with types, enums and patterns taken from AWS's botocore models. A value AWS would reject, such as an unknown instance type, is rejected with HTTP 422.
| Resource type | Identity | Operations |
|---|---|---|
| ec2_instance | Instance ID | add · modify · delete |
| security_group | Security group ID | add · modify · delete (attachments are derived from EC2 sg_ids) |
| rds_instance | Database ID | add · modify · delete |
| s3_bucket | Bucket name | add · modify · delete |
| lambda_function | Function name | add · modify · delete |
| network_acl | Network ACL ID | add · modify · delete (modify replaces complete entries and/or associated_subnet_ids) |
| iam_role_policy | Role ARN | modify (replaces the complete access_statements list) |
| route_table | Route table ID (AWS assigns it for an add; omit to get a placeholder) | add (vpc_id of a VPC in the snapshot; copies the VPC local routes; optional routes, associated_subnet_ids and tags) · modify (replaces the complete routes list; new internet-gateway routes need attachment evidence) |
| iam_role | Role ARN | add · modify (trust policy) · delete |
| rds_snapshot | Snapshot ID | add (manual snapshot of an existing database) · delete |
| ebs_volume | Volume ID (AWS assigns it for an add; omit to get a placeholder) | add (size_gb required, availability_zone, volume_type, tags) · delete |
| ebs_snapshot | Snapshot ID | delete |
| iam_user | User name | add |
| nat_gateway | NAT gateway ID (AWS assigns it; omit to get a placeholder) | add (subnet_id, connectivity_type public or private, allocation_id for a public NAT) |
Anything Emfirge cannot model is never treated as safe: it degrades the verdict to warn or block. Impossible input, such as from_port greater than to_port, is rejected with a clear HTTP 422. A missing value AWS requires, such as a NAT gateway subnet or an EBS volume availability_zone, is accepted with an explicit unspecified_values warning instead of a guessed default. An EBS volume add uses the AWS default volume type (gp2) when volume_type is omitted. Adding a route table associates associated_subnet_ids with it, which moves each subnet off its old explicit table. Hand-back creates only the route table; routes and associations on a branch-created table are reported as a gap, because AWS assigns the table ID. Most resource types (EC2 instances, security groups, RDS instances, S3 buckets, Lambda functions, EBS volumes, NAT gateways and route tables) carry tags. A tag change replaces the complete user tag set: AWS allows 50 user tags, keys up to 128 characters and values up to 256, and aws: tags are kept and cannot be changed. Tag changes do not change findings or reachability. They warn when IAM policies have conditions, because tag-based (ABAC) access is not evaluated.
Modify a resource
For example, disable the public-access flag on an existing database in the model. Use field names from Emfirge’s resource schema, not arbitrary AWS or Terraform property names.
emfirge_apply_change({
branch_id: "<branch_id>",
op: "modify",
resource_type: "rds_instance",
resource_id: "<database_id>",
fields: { publicly_accessible: false }
})
Add or delete a resource
An add needs the fields required by the resource schema. A delete identifies an existing resource and removes it from the branch model. Review the resulting edges and findings before drawing conclusions.
A removed model relationship does not fully describe application-level dependencies. Dependency breakage beyond the graph needs separate validation.
emfirge_apply_change({
branch_id: "<branch_id>",
op: "delete",
resource_type: "ec2_instance",
resource_id: "<instance_id>"
})